Read the docs
TI-2021-04725 Aliases CVE-2021-21645GHSA-2959-fj73-hm8p

Missing authorization in Jenkins Config File Provider Plugin

Priority LOW 22CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-862.

Summary

Jenkins Config File Provider Plugin 3.7.0 and earlier does not perform permission checks in several HTTP endpoints, attackers with Overall/Read permission to enumerate configuration file IDs.

Why it matters now

EPSS 0.00887 59th percentileScored 2026-11-07
Fix Fixed org.jenkins-ci.plugins:config-file-provider (Maven): 3.7.1Red Hat: 4 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
JenkinsJenkins Config File Provider Pluginup to 3.7.0—No fix listedCNA
—org.jenkins-ci.plugins:config-file-provider (Maven)before 3.7.13.7.1Patch availableGHSA-2959-fj73-hm8p
  • Jenkins Config File Provider Plugin VendorJenkins Affected up to 3.7.0 Fixed in — No fix listed CNA
  • org.jenkins-ci.plugins:config-file-provider (Maven) Vendor— Affected before 3.7.1 Fixed in 3.7.1 Patch available GHSA-2959-fj73-hm8p

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jenkins:config_file_provider:*:*:*:*:*:jenkins:*:*up to 3.7.0VulnerableJenkins
  • cpe:2.3:a:jenkins:config_file_provider:*:*:*:*:*:jenkins:*:* Versions up to 3.7.0 Vulnerable ·Jenkins

Remediation

  • Fix · GHSA-2959-fj73-hm8p org.jenkins-ci.plugins:config-file-provider (Maven) Fixed in 3.7.1 Advisory →

Red Hat 4 advisories

  • RHSA-2021:2437 Released 2021-07-27 · Red Hat rating Moderate
    OpenShift Container Platform 4.8.2 packages and security update
    • Red Hat OpenShift Container Platform 4.8 afterburn-5.0.0-1.rhaos4.8.el8, atomic-openshift-service-idler-4.8.0-202106281541.p0.git.39cfc66.assembly.stream.el8, butane-0.12.1-1.rhaos4.8.el8 +47
  • RHSA-2021:2431 Released 2021-07-02 · Red Hat rating Important
    OpenShift Container Platform 4.5.41 security update
    • Red Hat OpenShift Container Platform 4.5 jenkins-2-plugins-4.5.1623326336-1.el7, jenkins-2.277.3.1623846768-1.el7
  • RHSA-2021:2517 Released 2021-06-30 · Red Hat rating Important
    OpenShift Container Platform 3.11.462 bug fix and security update
    • Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins-3.11.1624366838-1.el7, jenkins-2.289.1.1624365627-1.el7
Show 1 more Red Hat advisories
  • RHSA-2021:2122 Released 2021-06-01 · Red Hat rating Important
    OpenShift Container Platform 4.7.13 packages and security update
    • Red Hat OpenShift Container Platform 4.7 cri-o-1.20.2-12.rhaos4.7.git9f7be76.el7, cri-o-1.20.2-12.rhaos4.7.git9f7be76.el8, cri-tools-1.20.0-3.el7 +2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
7Server-RHMTC-1.4Fixed—
8Base-RHMTC-1.4Fixed—
Red Hat OpenShift Container Platform 3.11Fixed RHSA-2021:2517
Red Hat OpenShift Container Platform 4.5Fixed RHSA-2021:2431
Red Hat OpenShift Container Platform 4.6Fixed—
Red Hat OpenShift Container Platform 4.7Fixed RHSA-2021:2122
Red Hat OpenShift Container Platform 4.8Fixed RHSA-2021:2437
Not affected: 3 products
  • Red Hat OpenShift Container Platform 3.11
  • Red Hat OpenShift Container Platform 4.5
  • Red Hat OpenShift Container Platform 4.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-21645
  2. 2026-10-03 Alias added: GHSA-2959-fj73-hm8p

References

Advisory 3

Other 2

  • TI-2021-04722 XML external entity injection in Jenkins Config File Provider Plugin CVSS 3.1HIGH 8.1
  • TI-2023-21168 Jenkins Config File Provider Plugin 952.va_544a_6234b_46 and earlier does not mask (i.e… CVSS 3.1HIGH 7.5
  • TI-2018-15887 A cross-site request forgery vulnerability exists in Jenkins Config File Provider Plugin… CVSS 3.0HIGH 8.1
  • TI-2021-04723 Incorrect authorization in Jenkins Config File Provider Plugin CVSS 3.1MEDIUM 6.5
  • TI-2017-14441 The Config File Provider Plugin is used to centrally manage configuration files that… CVSS 3.0MEDIUM 6.5
  • TI-2021-04724 Cross-site request forgery in Jenkins Config File Provider Plugin CVSS 3.1MEDIUM 5.4
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences